STIX 2.1 bundle

The active suspicious phishing feed as a STIX 2.1 Bundle: one identity object for phishunt, the OASIS TLP:CLEAR marking-definition, and one indicator per active detection ([domain-name:value = '...'] pattern). Updated every hour, same cadence and cache TTL as /feed.json. Each indicator's confidence is derived directly from that detection's own score (see the Site.score description) - it is never a constant across indicators, unlike feeds that hardcode one confidence value for every entry.